{
  "id": 6605314,
  "title": "Taming SPAs with VORTEX: How a Crawler Actually Understands React, Vue, and Angular",
  "url": "https://urgent.news/2026/09/10/taming-spas-with-vortex-how-a-crawler-actually-understands-react-vue",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-10T15:47:32.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/matarturo/taming-spas-with-vortex-how-a-crawler-actually-understands-react-vue-and-angular-57dn"
  },
  "original_language": "en",
  "account": "In the world of Single Page Applications (SPAs), security scanners often struggle to identify vulnerabilities. When a security scanner examines a modern SPA built with React, Vue, or Angular, it typically sees only two routes and zero critical vulnerabilities. However, this is far from comprehensive. The VORTEX Assessment Engine tackles this issue by creating a crawler that doesn't just read HTML, but actually executes the application like a real user would, observing the results and extracting valuable information.\n\nOne key aspect of the VORTEX crawler is its route discovery mechanism. Instead of relying on static HTML links, it actively interacts with the application by clicking, navigating, opening menus, and triggering transitions. This approach allows it to discover routes that are not immediately apparent in the initial HTML, such as those triggered by dropdown menus, lazy-loaded chunks, or route guards. By simulating user actions, the crawler ensures that it finds all relevant routes, even the hidden ones that might lead to critical vulnerabilities.\n\nAnother important aspect of the VORTEX crawler is its analysis of the static JavaScript bundle. Often, developers include sensitive information such as API keys directly in the source code, intending to replace them with environment variables later. However, when these keys end up bundled and minified in the final JavaScript file, they become publicly accessible. The VORTEX crawler detects such secrets by analyzing the static JavaScript bundle, catching these oversights before they can be exploited. This static JS bundle analysis is a powerful feature that many other DAST tools overlook, as it doesn't rely on network traffic or dynamic requests to identify vulnerabilities.\n\nFinally, the VORTEX crawler correlates its findings with the actual surface area of the application, rather than making assumptions. After mapping out the complete route tree and analyzing the JavaScript bundle, it conducts active security tests against the real application. This ensures that the identified vulnerabilities are not just theoretical but can be exploited in a real-world scenario. By correlating its findings with the actual application surface, VORTEX provides a more accurate and reliable assessment of the application's security posture. The crawler's approach to understanding SPAs is a game-changer, enabling security teams to identify vulnerabilities that other scanners would overlook, ultimately leading to more robust and secure applications.",
  "summary": "💡Let’s run a mental experiment. You open a SPA built with React. You point your favorite scanner—the one you've used for years, the one that \"never fails\"—to audit it. You wait. It generates a neat, polished report with a nice logo and a progress bar. And it tells you: \"2 routes found. 0 critical vulnerabilities.\" Two routes. In an application featuring a complete dashboard, an admin panel, over…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}